Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)

From: "Theodore Ts'o" <tytso@mit.edu>
To: Kees Cook <keescook@chromium.org>
Cc: linux-kernel@vger.kernel.org,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Ben Hutchings <ben@decadent.org.uk>,
	Rob Landley <rob@landley.net>, Al Viro <viro@zeniv.linux.org.uk>,
	Ludwig Nussel <ludwig.nussel@suse.de>,
	Alessandro Rubini <rubini@gnudd.com>,
	linux-doc@vger.kernel.org
Subject: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)
Date: Tue, 28 Aug 2012 10:41:10 -0400	[thread overview]
Message-ID: <20120828144110.GA23035@thunk.org> (raw)
In-Reply-To: <20120827203215.GA16637@www.outflux.net>

On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
> Since the debugfs is mostly only used by root, make the default mount
> mode 0700. Most system owners do not need a more permissive value,
> but they can choose to weaken the restrictions via their fstab.
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>

I agree with this patch, but it would also be good if we could try to
harden debugfs in general.  Some ideas that might be worth discussing,
for example?

1) Adding a per-module flag, so things in debugfs only show up if they
are explicitly requested (you know, for debugging purposes).  If most
people are using debugfs for access to ftrace and powertap (my use
case), there's no point making directories for other device drivers
and file systems visible.

2) Can we find a pattern of common security #fail's with debugfs
files, and try to sweep through and fix them?

There may be other ideas, and again, I'm not saying that this means we
shouldn't lock down the permissions on debugfs.  But a both/and
approach might be useful here....

							- Ted